{"id":16398,"date":"2019-09-24T10:10:03","date_gmt":"2019-09-24T18:10:03","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2019\/09\/24\/news-10139\/"},"modified":"2019-09-24T10:10:03","modified_gmt":"2019-09-24T18:10:03","slug":"news-10139","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/09\/24\/news-10139\/","title":{"rendered":"15,000 webcams vulnerable to attack: how to protect against webcam hacking"},"content":{"rendered":"

Credit to Author: Christopher Boyd| Date: Tue, 24 Sep 2019 17:19:23 +0000<\/strong><\/p>\n

Webcams may have been around for a long time<\/a>, but that doesn\u2019t mean we know what we\u2019re doing with them. Webcam hacking has been around for equally as long, yet new research from Wizcase<\/a> indicates that more than 15,000 private, web-connected cameras are exposed and readily accessible to the general public.<\/p>\n

So forget hacking, cybercriminals can just take a stroll through the Internet and grab whatever webcam footage they like for the taking.<\/p>\n

Malware targeting web cameras is a mainstay of the malicious hacker\u2019s toolkit. Sometimes it\u2019s for profit and blackmail. Often the threat of footage that doesn\u2019t exist<\/a> is mashed up with old data breaches to force people to part with their money.<\/p>\n

Other times, people would hack PCs and reveal shock meme footage on a victim\u2019s desktop, then capture screenshots for posterity, sharing them on hacker forums for giggles and bragging rights.<\/p>\n

Mainly, what seems to be happening a lot right now is a whole lot of negligence. People are connecting their cameras to the Internet without any security features enabled. Worse still, many cams don\u2019t have any security features to enable in the first place.<\/p>\n

A persistent problem<\/h3>\n

We\u2019ve spoken at length as to why security features aren\u2019t necessarily advertised<\/a> front and centre in the instructions of IoT devices. Companies want to seduce buyers with cool tools and amazing features, not ram \u201cSET UP A PASSWORD\u201d down their throats on page one of the instruction booklet. It\u2019s strange, considering how safety and security messaging is typically high priority for other products.<\/p>\n

When was the last time you saw a car advertised without some sort of passing mention of seatbelts, or how good the rollcage is, or how many airbags they have, or words like \u201csafety for the whole family\u201d? Epilepsy, violence, and adult language warnings are now a prominent feature of video games, movies, and television. Even social media comes with trigger warnings.<\/p>\n

Computer equipment, though? Somehow it seems to run the risk of making the cool toys very uncool indeed. You know what\u2019s definitely<\/em> worse than security warnings all over the place?<\/p>\n

Default configurations exposing your webcam\u2019s stream to the whole world.<\/p>\n

Webcam hacking the planet<\/h3>\n

Researchers from Wizcase discovered the following:<\/p>\n

Around 15,000 webcams located in homes, businesses, places of worship, and many more were placed online without additional security measures. Regions spanned the globe, from Argentina and Brazil to the UK and Vietnam. Both adults at work and children presumably at home were all easily viewable after the cams were accessed remotely. This is a clear privacy and security risk, especially in terms of potential damage threatened by phishing<\/a>, blackmail, sextortion, and more.<\/p>\n

The cams offered up problems such as unsecured P2P networking and lack of password authentication on devices with Universal Plug and Play (UPnP)<\/a> enabled, and easily guessable default login passwords for admin. In situations where consumers expected products to work \u201cout of the box,\u201d this problem was exacerbated by a lack of security knowledge.<\/p>\n

In addition, not only were the cam streams accessible, but there were also other areas where admin could be compromised by webcam hacking techniques. Geolocation and potential control of devices was also possible.<\/p>\n

Some of the devices looked at in the research include the following:<\/p>\n